CVE-2026-53670

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

EUVD-2026-70229

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

EUVD-2026-69919

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-84807

Kimai (kimai/kimai) versions prior to 2.65.0 contain an improper authorization flaw in its default team-creation endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team). An authenticated user holding project permission-management privileges can crea...

CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-73708

A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable...

CVE-2026-63138

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-73708 Fault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable...

EUVD-2026-69435

A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable...

CVE-2026-73708

A business logic vulnerability in the API of HPE Networking Fabric Composer allows an authenticated low-privilege operator user to gain elevated privileges and modify settings beyond their authorized level. The CVSS 3.1 score is 8.3 (HIGH) with a network vector, low attack complexity, and low pri...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-63138

CVE-2026-63138 is a NoSQL injection (CAPEC-676) vulnerability in Kibana , classified as Improper Neutralization of Special Elements in Data Query Logic (CWE-943). An authenticated user with access to the affected query functionality can submit specially crafted input that alters the intended quer...

EUVD-2026-69575

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

SUSE CVE-2026-72376

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

PUB-A-511933767

In smmudetachdev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ASB-A-471796626

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-498720726

In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508718527

In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...